News for hackers. Stuff that matters.
Re:Ask HN: How do you handle DDoS attacks? by simon_acca on Sunday August 28, 2016 @03:45PM (#12378150)
Why would you turn off compression? A given amount of requests is more burdensome on the CPU when decompression is to be performed.
Re:Ask HN: How do you handle DDoS attacks? by dogma1138 on Sunday August 28, 2016 @03:53PM (#12378196)
Because you want to test it with it on and off and understand the impact it has. Text (Javascript, HTML) compresses rather well (on average 3 to 1 or better) it's considerably more likely that you are going to hit a networking limit than than a CPU limit when not using GZIP or any other compression method. So when you do stress or load testing you really want to issue the same requests with and without the Accept-Encoding: compress, gzip or any similar headers.

Also in some cases you want to disable accepting GZIP on the server side completely because if you accept GZIP encoded requests an attacker can send very large requests that compress very well forcing you to decompress them eating up a lot of memory and CPU cycles on your side only to discard them. In principle you want to accept only non-compressed requests but send compressed responses to save bandwidth, but in any case you want to know how your service/application scaling works in with all cases and combinations.

Re:Ask HN: How do you handle DDoS attacks? by bch on Sunday August 28, 2016 @04:03PM (#12378243)
Assuming the remote is actually decompressing, and the origin isn't dynamically compressing for each request.
Re:Ask HN: How do you handle DDoS attacks? by dogma1138 on Sunday August 28, 2016 @04:06PM (#12378255)
Even if the remote is decompressing it doesn't matter a botnet owner or some one who compromised a few AWS accounts doesn't care it won't really slow them down. CPU's are pretty fast at compression and when a site is easily 3-4 times the size when not served compressed you are going to hit your network cap limit faster than exhausting the CPU even with dynamic compression and no caching under most circumstances.